CVEvulnerability

CVE-2015-7545

9.8 CRITICAL Published 2016-04-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-04-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20, CWE-284

Description

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Affected configurations

• git project git (<= 2.3.9) • git project git 2.4.0 • git project git 2.4.1 • git project git 2.4.2 • git project git 2.4.3 • git project git 2.4.4 • git project git 2.4.5 • git project git 2.4.6 • git project git 2.4.7 • git project git 2.4.8 • git project git 2.4.9 • git project git 2.5.0 • git project git 2.5.1 • git project git 2.5.2 • git project git 2.5.3 • git project git 2.6.0 • redhat software collections 1.0 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 15.04 • canonical ubuntu linux 15.10 • opensuse opensuse 13.1 • opensuse opensuse 13.2

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-284 Improper Access Control weakness

References